The US Justice Department said on Thursday 12 November that it has obtained court authorization to seize or restrain more than $1.2 billion of the crypto stolen from Binance on or about 29 October, a theft the FBI pins on North Korean military hackers it calls TraderTraitor. In the same release from its Office of Public Affairs, the department said government and private-sector efforts have frozen more than $2.7 billion of the more than $6 billion taken. It is the first legal step toward taking the money away from the thieves. It is not a forfeiture, and nothing has been handed back to anyone.
The $1.2 billion is not fresh money pulled out of the hackers’ wallets. It is a slice of what was already frozen in the first days after the Binance hack, mostly by stablecoin issuers. What changed on Thursday is the legal status of that slice: a court has now allowed the government to take hold of it, or at least to keep it blocked, while the case moves on.
By about 17:45 UTC on Friday 13 November, a day later, we found no public complaint, warrant or case number, no statement from Binance on the announcement, and no new figure from the department. The release does not name the court. This piece follows our report on the FBI naming TraderTraitor on 1 November, when the US had attributed the attack and asked operators to block addresses but had not touched any of the money.
What the DOJ said about the Binance hack funds on 12 November
The release, which the department marked as updated on 12 November, gives four numbers and very little paperwork. More than $6 billion stolen. More than $2.7 billion frozen. More than $1.2 billion covered by court authorization to seize or restrain. About half of the breach halted, in the words of the Criminal Division.
Assistant Attorney General A. Tysen Duva, who runs that division, said the response helped “immediately halt about half of this historic breach”. M. Scott Proctor, the principal deputy assistant attorney general for national security, framed the case as a weapons matter: “North Korea’s government bankrolls its rogue regime and illicit weapons program through cryptocurrency theft”. He added that his division would use every tool to “seize and return North Korea’s ill-gotten gains”, without saying to whom anything would be returned.
Several teams are listed. The National Security Division’s National Security Cyber Section and the Criminal Division’s Computer Crime and Intellectual Property Section work the case with the US Attorney’s Office for the District of Columbia, which the department says worked with virtual asset service providers to stop the funds. The FBI’s Los Angeles Field Office, through its Cyber Division and Virtual Asset Unit, coordinates the recovery with the Secret Service and IRS Criminal Investigation.
The release also recalled the Cyber Alert the FBI, the Secret Service and IRS-CI issued the week before, which asked exchanges and other providers to block transactions tied to the addresses the hackers use. The hackers are still moving money through bridges, mixers and exchanges, according to the release.
The same release covered a second, unrelated operation: the seizure of cloud infrastructure behind FaceStealer, a North Korean fake video-call scheme the FBI links to more than $400 million in thefts over 18 months. The FBI could not say whether FaceStealer played any part in the Binance breach, The Record reported. We cover that seizure separately.
Frozen, seizable, forfeited: three different things
Each of the three stages gives the government a different power over the coins.
Frozen means an issuer or a platform has blocked the tokens where they sit. For dollar stablecoins such as USDT and USDC, the issuer can blacklist an address so the tokens can no longer move. Until this week the Binance funds had simply been frozen at the token issuers, Bitcoin Magazine wrote in its reading of the announcement. A freeze stops the thief. It does not decide who owns the tokens.
Court authorization to seize or restrain is the next step. A judge has agreed that the government may take control of the assets, or keep them restrained, because there is reason to believe they are proceeds of a crime. The department chose its words with care: it said seize or restrain, and it did not say how much falls under each verb.
Forfeiture comes last. It is the court ruling that transfers ownership to the United States, usually after a civil forfeiture complaint, notice to anyone who may claim the property, and time for those claims. Only after forfeiture can the money be paid out to victims or kept. None of that has been announced for the Binance funds.
Headlines saying the US seized $1.2 billion run ahead of the facts, and the release itself is not consistent on this. The US Attorney for the District of Columbia, Jeanine Ferris Pirro, spoke in it of “seizing more than $1.2 billion of their stolen assets”, while the department’s own text says seize or restrain. What exists today is an authorization over part of the frozen funds, not a completed forfeiture. For the basics of how issuer-controlled tokens work, see our glossary entry on stablecoins.
Where the $2.7 billion frozen comes from
The Justice Department did not say who froze what. The earlier statements of the issuers fill part of the gap, though no source ties their numbers to the department’s total.
On 30 October, the day after the theft, Circle chief executive Jeremy Allaire said his company had frozen more than $800 million in USDC, and Tether chief executive Paolo Ardoino said Tether had frozen nearly $1.57 billion in USDT, Finance Magnates reported. Together that was more than $2.37 billion. The Secret Service said at the time it was working with Circle. Binance put the total frozen by its industry partners at around $3 billion.
On 3 November, Binance said roughly $2.85 billion had been frozen or intercepted, according to Bitcoin Magazine. Blockchain analytics firm Elliptic gives the same $2.85 billion as frozen or seized, out of $6.43 billion it counts as stolen.
The department’s figure, more than $2.7 billion, sits a little below those private counts. It does not explain the gap. It may only count what the government can document, or it may leave out tokens frozen by platforms outside its reach; the release does not say, and we will not guess.
| Figure | Amount | Source and date |
|---|---|---|
| Stolen from Binance | More than $6 billion | Justice Department, 12 November |
| Stolen from Binance | $6.43 billion | Elliptic tracker |
| Covered by Binance from its own funds | $6.34 billion | Binance, via Bitcoin Magazine, 12 November |
| USDT frozen by Tether | Nearly $1.57 billion | Paolo Ardoino, via Finance Magnates, 30 October |
| USDC frozen by Circle | More than $800 million | Jeremy Allaire, via Finance Magnates, 30 October |
| Frozen or intercepted | About $2.85 billion | Binance (3 November) and Elliptic |
| Frozen | More than $2.7 billion | Justice Department, 12 November |
| Court authorization to seize or restrain | More than $1.2 billion | Justice Department, 12 November |
On the department’s rounded figures, the court authorization covers about 44% of what is frozen, and the frozen total is about 45% of what was stolen.
What the release leaves out
The announcement is short on the details a court filing would normally carry. We found no complaint or warrant on CourtListener on Friday morning; Bitcoin Magazine noted that no court papers were posted with the announcement, and The Record names no court either.
- The court that granted the authorization, and the case number.
- Which assets the $1.2 billion is made of, and which issuers or platforms hold them.
- How the $1.2 billion splits between seizure and restraint.
- Who has custody of the tokens today.
- Any timetable for forfeiture, or for a claims process.
Nor did prosecutors say how much of the frozen amount is bitcoin. The FBI alert of late October said the stolen assets were being converted primarily into ether, Bitcoin Magazine noted.
The District of Columbia appears in the release only as a partner office. Some outlets wrote that a Washington court granted the order. The release does not say that, so we do not either.
Binance already paid its users, so who gets the money?
The people who lost coins in this hack, Binance’s users, have already been made whole by Binance itself. The exchange said it covered the affected assets, $6.34 billion, by replacing the tokens from company money: its Secure Asset Fund for Users, part of its futures insurance fund and its treasury, according to Bitcoin Magazine. That is replacement, not recovery. Our first report on the Binance hack covered how the attack started.
So if the frozen tokens are ever forfeited, the most obvious party with a loss is Binance, which carried the cost. Whether the exchange will file a claim, and whether the department would back it, is unknown. Neither the release nor any statement we could find addresses it. Binance had not commented on the announcement by Friday evening, as far as we could find, and The Record and Finance Magnates carried no Binance statement either.
Under US forfeiture rules, victims usually petition for remission once a court has ordered forfeiture. Here the users have been reimbursed already, which leaves the exchange as the party carrying the loss. Proctor’s promise to “return” the gains is the only hint in the release, and it names no recipient.
The other half is still moving, slowly
Elliptic’s running analysis of the laundering, last updated around 07:30 UTC on 13 November, gives the clearest picture of the money the US has not stopped. About $2.8 billion remains in addresses linked to the theft, mostly as ether and bitcoin. The nine largest addresses, which hold 89% of the attackers’ ether, have not moved since 30 October. Another 68,300 ETH or so sits spread across about 830 smaller addresses. Since the theft the laundering has used almost 27,000 wallets on at least 16 blockchains, Elliptic counts.
Some of the rest is on the move. About 11,000 ETH has gone into the Tornado Cash mixer since 8 November, Elliptic counts. Earlier, around 12,200 ETH went through the THORChain cross-chain protocol into bitcoin by 4 November, and THORChain halted some swaps several times between 31 October and 12 November. Elliptic’s conclusion on the cash side is short: a negligible amount has likely been cashed out so far.
The hackers are also trying newer tricks. Elliptic found they created their own worthless tokens to move stolen value through decentralized exchange pools, so the funds never pass directly from one wallet to another, The Record reported. We wrote up that finding in our piece on the NEAR memecoins used for laundering; so far only a small amount has moved that way.
The Record also reported that DTEX researcher Michael Barnhart described TraderTraitor as one of the units APT38 was split into after the 2016 Bank of Bangladesh heist, a group that usually hands stolen funds quickly to Chinese money launderers for a lump sum or a percentage. Elliptic draws the same line: the coins already being laundered may now be with Chinese networks, while the ones that have not moved are very likely still held by North Korea.
North Korea denies, the US keeps tracing
Pyongyang rejects the accusation. Kim Yo Jong, the sister of leader Kim Jong Un, denounced the FBI’s attribution, and state media called the accusation a “grave political provocation”, Yonhap reported on 3 November citing KCNA, according to CNBC. Elliptic and Chainalysis both link the theft to North Korean actors. The Justice Department did not respond to the denial in its release.
Prosecutors said their work to trace, freeze, seize and forfeit the funds goes on. In practice, the next public signs would be a civil forfeiture complaint, which would name the court and list the assets, or a fresh FBI notice adding addresses for exchanges to block.
What it changes for users in Europe
On the issuers’ own figures, most of the early freezes were in two dollar stablecoins, USDT and USDC, so the issuers’ power to block tokens sits at the heart of this case. For euro-area holders of USDC, Circle’s European unit has been watched by the European Banking Authority since 12 November, as we explained in our piece on the EBA taking over USDC supervision. An issuer can blacklist an address on its own token wherever the holder sits, which is how Tether and Circle could act within a day of the theft.
For Binance customers in both countries the more pressing date is unrelated to the hack: the exchange closes their accounts on 31 December.
Dates and questions to watch
No date has been set for anything in this case. The open questions are concrete, though. Will the department file a forfeiture complaint, and in which court? Do the roughly $1.5 billion of frozen tokens, not yet covered by a court order, get one too? Do the nine dormant addresses holding most of the attackers’ ether start to move?
And who claims the money at the end? Binance paid out $6.34 billion of its own funds. If any of the $1.2 billion is forfeited, that is the claim to watch.